Uploaded July 2022 | Updated September 2026, 1 day ago

---

#short
Let's learn a quick tip of how to scan a pcap for suspect HTTP User Agents, which Malware sometimes uses to initiate requests.

Link to the pcap:
malware-traffic-analysis.net/2020/05/28/index.html
The password to unzip the file is "infected"

Tshark command:
tshark -r example.pcap -T fields -e http.user_agent | sort | uniq -c

In Powershell:
tshark -r example.pcap -T fields -e http.user_agent | sort -unique

// Contact Me //
LinkedIn: linkedin.com/in/cgreer
YouTube: youtube.com/c/ChrisGreer
Twitter: twitter.com/packetpioneer